CVE-2026-18401: Allocation of Resources Without Limits or Throttling

The non-blocking asynchronous JSON parser in jackson-core does not enforce the maxNumberLength constraint defined in StreamReadConstraints default: 1000 characters. An attacker able to submit JSON to an application that uses the async parser API can supply a number token of arbitrary length,...

OSV-2024-24 Security exception in java.base/java.util.Arrays.copyOf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=65740 Crash type: Security exception Crash state: java.base/java.util.Arrays.copyOf com.fasterxml.jackson.core.util.TextBuffer.expandCurrentSegment com.fasterxml.jackson.dataformat.cbor.CBORParser.finishShortText...

PT-2024-40687 · Fasterxml · Jackson Dataformat Cbor

Name of the Vulnerable Software and Affected Versions: Jackson dataformat CBOR affected versions not specified Description: The issue is related to a security exception in the Jackson dataformat CBOR library. The crash occurs in the java.base/java.util.Arrays.copyOf method, which is called by...